Question

Your company hosts a web application on an Azure App Service (Premium v3) that is currently accessible over the public internet. You are deploying Azure Front Door in front of the application and must ensure that the App Service origin can only be reached through Front Door, with traffic never traversing the public internet between Front Door and the origin. You want to avoid managing NSGs, service tags, or IP allow-lists on the origin. Which approach meets these requirements?

Accepted Answer

Use Azure Front Door Standard/Premium tier and enable Private Link to the App Service origin, then approve the private endpoint connection from the App Service.

Answer

Use Azure Front Door Standard tier and restrict the App Service access using the AzureFrontDoor.Backend service tag in an access restriction rule.

Answer

Deploy the App Service into a virtual network with regional VNet integration and configure Front Door to route to the integration subnet.

Answer

Use Azure Front Door (classic) and configure the X-Azure-FDID header validation on the App Service to reject direct requests.